A sophisticated data-theft and loan fraud ring has been busted following the arrest of a former private insurance company employee. The mastermind, Imran Khan, along with his accomplice Pulkit Sharma, was apprehended by law enforcement in Panipat, Haryana, for allegedly orchestrating an insider scam that siphoned off ₹24 lakh by taking fraudulent loans against unsuspecting customers’ insurance policies.
The case, registered by Mumbai’s West Cyber Police, highlights a dangerous vulnerability in corporate data security and served a stark warning to retail policyholders regarding financial identity theft.
The Modus Operandi: Anatomy of an Insider Breach
The fraud was meticulously executed by exploiting the high level of trust that retail consumers place in door-to-step corporate representatives. The scam unfolded through a highly calculated, multi-step process:
How the Ring Was Undone
The complex scheme began unraveling in September 2025 when a sharp-eyed policyholder from Gurugram spotted a stray, unauthorized loan notification text. He immediately flagged the discrepancy to the insurer’s specialized Fraud Control Team, triggering a deep internal audit.
The internal investigation revealed that the accused had visited that specific customer’s residence over a tight three-day window in July. A sweeping backward audit of Khan’s internal corporate footprint exposed a trail of 15 identical fraudulent loans processed across different accounts, using cloned profiles to redirect funds away from genuine customers.
While Khan and Sharma are currently in police custody, a third suspect and active insurance employee, Anjali Rani, has been formally named in the police charge sheet and remains at large. Law enforcement has seized three smartphones, six distinct chequebooks, and two bank passbooks used to manage the illicit cash flows.
Red Flags & Last-Mile Defense Strategies
This incident underscores the critical importance of maintaining strict digital hygiene. To insulate your assets from identity theft, implement these absolute guardrails:
Never Hand Over Your Device: Never unlock or hand your physical phone over to an agent, banking representative, or corporate staffer.
The OTP Zero-Trust Rule: Never read out or share OTPs, TPINs, or app passwords with anyone, regardless of their corporate credentials.
Audit Linked Credentials: Periodically log into your official insurance portlets to manually verify that your registered phone number, email ID, nominee, and banking details are correct.
Verify Immediate Profile Changes: Treat any unexpected confirmation text regarding profile updates, bank changes, or small Re 1 deposits as a critical security breach and contact official customer service immediately.
